Ashley Madison’s Owners Give In to Temptation To Misuse The DMCA

Ashley Madison’s Owners Give In to Temptation To Misuse The DMCA

Copyright is a poor tool for making embarrassing information disappear from the Internet. It rarely succeeds, and often draws more attention to whatever was embarrassing or harmful. Copyright isn’t designed for keeping secrets (in fact, it was generally meant to do the exact opposite by encouraging disclosure). Yet people keep trying to use copyright law, in part because takedown notices under the Digital Millennium Copyright Act are quick and easy, and because the rhetoric of “theft” and threats of ridiculously large penalties can be quite scary.

The latest to abuse the DMCA is Avid Life Media, the owner of the Ashley Madison website, which bills itself as “the most famous name in infidelity and married dating.” Ashley Madison’s owners have been sending numerous DMCA takedown notices to platforms like Twitter, Reddit, and others in an attempt to stop the dissemination of millions of names and email addresses of the site’s users. The data was posted publicly this week following a hack of the site in July. While there’s no doubt that the leak is embarrassing and potentially disastrous for the millions of people who have been revealed as users of a site that promotes marital infidelity, Ashley Madison’s attempts to use the DMCA to put the genie back in the bottle are misguided, and in some cases, may violate the DMCA itself.

The DMCA creates a “safe harbor” that protects user-generated content websites against liability for copyright infringement by their users. To qualify for the safe harbor, sites have to accept notices of alleged infringement containing certain information and the signature of a responsible party. Upon receiving a notice, a site needs to “expeditiously” disable access to the material identified as infringing in order to receive the protection of the safe harbor. (There are other requirements as well.) The user who posted the material can send a counter-notice if they believe the posting was lawful. After a counter-notice, the site is supposed to put the material back up within 10 to 14 business days. At that point, the rightsholder must file a lawsuit against the poster to have the material taken down.

Although the law doesn’t require websites to use the DMCA process, many choose to do so to get the protection of the safe harbor. It’s become a standard practice for websites based in the U.S. and sometimes in other countries. Importantly, the DMCA process applies only to copyright claims. It can’t be used for other complaints like defamation, invasion of privacy, trademark infringement, trade secret disclosures, or violations of a website’s terms of use or community guidelines.

The DMCA process is relatively quick and easy. Instead of filing a lawsuit or tracking down the poster, all it requires is an email to the site, or filling out a Web form. After that, the material disappears for at least ten days, and often permanently. This ease of use makes it incredibly tempting to use the DMCA as a tool for censoring online speech that someone doesn’t like, for any number of reasons, from political to personal, but often having no connection to copyright infringement. Sending DMCA notices for material that’s not infringing is against the law, and it can leave the sender liable for damages. But claims for takedown abuse that actually make it to court are rare, and the temptation to use the DMCA as a quick way to get “stuff I don’t like” off of the Internet remains strong.

Over the past week, Avid Life has been using DMCA notices to try to contain a damaging and highly embarrassing disclosure of personal information. Regardless of whether their goal is a noble one, their use of the DMCA is problematic. Avid Life probably doesn’t have any copyrights in most of the material the company is trying to suppress. According to news reports, the data leak contained names, addresses, phone numbers, encrypted passwords, and e-mail addresses of Ashley Madison users, as well as users’ own descriptions of what they were looking for on the site. Mere facts, like names, addresses, and phone numbers, aren’t copyrightable.

Biographical descriptions or pickup lines written by users can be copyrightable, but the copyright belongs to the users, not the site owners. While it might be possible for a website to have its users transfer their copyrights to the site’s owner, this is relatively difficult and rarely done, and we would be surprised if Avid Life successfully did this to Ashley Madison users. It’s more likely that users simply gave the site a “non-exclusive license” to store and post their material, but that sort of license doesn’t give the site any authority to send DMCA takedowns on users’ behalf.

It’s possible for the site to have a copyright in the “selection and arrangement” of users’ data, but only if they used some creativity in selecting users or putting their database in order. Obvious forms of organization like an alphabetical listing don’t give the database owner any copyright. To claim this form of copyright, Avid Life would have to show that someone copied not just the user data but Avid’s creative arrangement of the data. This is also unlikely.

According to reports, Avid’s DMCA takedown notices were vague about the claims they were making. The notices contained statements like “Avid owns all intellectual property in the data.” But without a valid claim of copyright infringement, a DMCA takedown notice isn’t valid, and websites don’t need to comply with it. While some reposts and discussions of the Ashley Madison leak have been taken down, others remain up, and Avid’s DMCA campaign is unlikely to curtail access to the data very much.

There are likely millions of people who would like to see the Ashley Madison user data disappear from the Internet, including the site’s owner. Undoubtedly, the leak has done and will do great damage. But DMCA notices are not a tool for putting the genie back in the bottle. Using them for non-copyright purposes is against the law, and encourages more abuse, such as censoring political commentary and criticism. If Avid Life doesn’t actually hold any copyrights in the user data—the most likely scenario—then their use of the DMCA is not only ineffective but wrong.

Related Updates

A fight over unmasking an anonymous Reddit commenter has turned into a significant win for online speech and fair use. A federal court has affirmed the right to share copyrighted material for criticism and commentary, and shot down arguments that Internet users from outside the United States can’t...

San Francisco – The creator of popular post-fight commentary videos on YouTube is demanding an end to the Ultimate Fighting Championship (UFC)’s unfair practice of sending takedown notices based on bogus copyright claims. The creator, John MacKay, is represented by the Electronic Frontier Foundation (EFF). MacKay operates the “Boxing...

San Francisco – On Monday, May 6 at 11am, the Electronic Frontier Foundation (EFF) will argue that a San Francisco court should quash a subpoena from the Watch Tower Bible and Tract Society aimed at getting the identity of an anonymous Reddit commenter. Watch Tower is the supervising body...

Get ready for a tale as good as anything you’d see on television. Here’s the sequence of events: the website TorrentFreak publishes an article about a leak of TV episodes, including shows from the network Starz. TorrentFreak tweets its article, Starz sends a copyright takedown notice. TorrentFreak writes about the...

In a stunning rejection of the will of five million online petitioners, and over 100,000 protestors this weekend, the European Parliament has abandoned common-sense and the advice of academics, technologists, and UN human rights experts, and approved the Copyright in the Digital Single Market Directive in its entirety...

With only days to go before the final EU debate and vote on the new Copyright Directive (we're told the debate will be at 0900h CET on Tuesday, 26 March, and the vote will happen at 1200h CET), things could not be more urgent and fraught. That's why...

Last week, Facebook CEO Mark Zuckerberg announced a new “privacy-focused” direction for the company that, while sounding great in theory, also set off several alarm bells—including concerns about competition as the company moves to make its messaging properties indistinguishable from one another. As usual for Zuckerberg, it’s all...

Three years ago, we warned of a string of dangerous new policy proposals on the horizon. Under these proposals, platforms would be forced to implement copyright bots that sniffed all of the media that users uploaded to them, deleting your uploads with no human review. It’s happening. The European...

EFF has just filed an amicus brief in support of Google’s petition asking the U.S. Supreme Court to review the long-running case of Oracle v. Google. The case asks whether functional aspects of computer programs are copyrightable, and...

If you were in Washington, D.C. last week, you had a chance to be one of the lucky recipients of a parody newspaper spoofing the Washington Post and crowing about the “Unpresidented” flight of Donald Trump from the Oval Office as he abandoned the presidency. The spoof, created by activist...